Guide
HIPAA compliance vendor risk assessment
Before a vendor touches protected health information, you need a business associate agreement and evidence that the Security Rule safeguards actually exist. This checklist walks through what to confirm, what evidence to ask for, and how to record the decision.
Start with scope
Is the vendor a business associate?
If the vendor creates, receives, maintains, or transmits protected health information (PHI) on your behalf, it is a business associate and needs a signed BAA before it touches production data. A vendor that only sees de-identified or aggregate data may not be — but write down the reasoning either way.
What PHI does it actually touch?
List the data elements, where they are stored, who at the vendor can see them, and whether support staff or subcontractors can access them. "HIPAA compliant" on a pricing page is a claim, not scope.
Which plan includes the compliance controls?
Audit logs, SSO, and BAAs are often gated behind an enterprise tier. Verify the safeguards you are relying on are available on the plan you are actually buying.
Are subcontractors covered?
A business associate must flow HIPAA obligations down to its own subcontractors. Ask for the subprocessor list and the commitment to notify you before it changes.
The HIPAA vendor checklist
Record a verdict and a cited source for every line. Anything you cannot source is an unknown, and unknowns belong in the questionnaire you send back to the vendor — not in the approval.
Business associate agreement
- Signed BAA in place before any PHI is transmitted
- Permitted uses and disclosures of PHI are defined and limited
- Subcontractor flow-down obligations are explicit
- Return or destruction of PHI on termination, including backups
- Right to obtain records demonstrating the vendor's compliance
Technical safeguards (Security Rule)
- Encryption of PHI in transit and at rest, with stated standards
- Unique user identification and automatic session termination
- Audit controls: activity logs covering PHI access, exportable to your SIEM
- Integrity controls that detect improper alteration or destruction of PHI
- Documented key management and, where relevant, customer-managed keys
Administrative safeguards
- Documented HIPAA security risk analysis and risk management plan
- Assigned security official and workforce HIPAA training
- Role-based access with minimum-necessary enforcement and periodic reviews
- Sanction policy for workforce members who violate PHI policies
- Contingency plan: data backup, disaster recovery, emergency mode operations
Physical safeguards & hosting
- Hosting model and named infrastructure providers, with their attestations
- Facility access controls and media disposal / reuse procedures
- Workstation use and security policies for staff handling PHI
- Data residency, including where backups and replicas live
Breach notification
- Contractual notification timeline for suspected or confirmed breaches
- Defined content of the notice: scope, individuals affected, remediation
- Cooperation with your own 60-day individual notification obligation
- Incident response testing evidence, not just a written policy
Independent assurance
- HITRUST CSF certification or a HIPAA-mapped SOC 2 Type II report
- Recent penetration test summary and vulnerability management SLAs
- Scope statement: does the report cover the product and region you use?
- Report date — treat anything older than 12 months as stale
A note on "HIPAA certified"
There is no government HIPAA certification. A vendor can only demonstrate compliance through a signed BAA, its own documented safeguards, and third-party assurance such as HITRUST or a SOC 2 Type II report mapped to HIPAA. Treat a "HIPAA certified" badge as a prompt to ask which of those three it means.
Automate the first pass
Point ComplianceCheckr at the vendor's trust center, security page, or a security PDF and it grades the vendor across security, privacy, certifications, access control, reliability, and contractual risk — quoting the source text as evidence and saving the result so you can approve, deny, or revisit it later.
Related checklists: the SOC 2 compliance checklist, the ISO 27001 checklist, and the general vendor risk assessment guide.